CVE-2020-12832

CRITICALNuclei

simplefilelist simple-file-list Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-12832 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 2, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

simple-file-list

Browse simplefilelist / simple-file-list
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Simple File List - Path TraversalCVSS 9.8

Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory.

Impact

Attackers can delete arbitrary files on the server, potentially causing data loss or service disruption.

Remediation

Update to version 4.2.8 or later.

WeaknessesCWE-22
Authorsriteshs4hu
Template tagscvecve2020wpwordpresswp-plugintraversalsimple-file-listlfivkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/422360b9-4c70-4fd9-9833-375f1294bd7a/ http://nvd.nist.gov/vuln/detail/CVE-2020-12832

Source: ProjectDiscovery

References

4